MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c
SHA3-384 hash: 88a4bf5f602467c76b0e5674b9f7383cc9b27216146ab438e8ec2a128c5147be7d8afc7aaf29f70c1b9b00436f869486
SHA1 hash: 5a7ba12257eeaa7fd8939f0b3f3d0f72312f8b09
MD5 hash: 816a22f036e9479e6c5c21a66fb994c9
humanhash: delta-crazy-wolfram-rugby
File name:816a22f036e9479e6c5c21a66fb994c9.exe
Download: download sample
File size:156'160 bytes
First seen:2020-10-08 17:49:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 3072:zrarlKAUco2H3E1x+N7ZMtcSfeXNbSuhQr:zEdUcTXEf+HMeSfEBc
Threatray 9 similar samples on MalwareBazaar
TLSH 41E31005ED2BDD77FDB437B6F82689EE9B315C28AC53E359420B0CA99D1E2C005D3266
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69335/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Launching a process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/485896
Signature
Antivirus / Scanner detection for submitted sample
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 295420 Sample: xSPCeoEl8E.exe Startdate: 08/10/2020 Architecture: WINDOWS Score: 72 39 Antivirus / Scanner detection for submitted sample 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Machine Learning detection for sample 2->43 45 2 other signatures 2->45 8 xSPCeoEl8E.exe 1 2->8         started        process3 file4 37 C:\Users\user\AppData\...\xSPCeoEl8E.exe.log, ASCII 8->37 dropped 47 Injects a PE file into a foreign processes 8->47 12 xSPCeoEl8E.exe 1 1 8->12         started        signatures5 process6 signatures7 49 Disables Windows Defender (via service or powershell) 12->49 15 powershell.exe 23 12->15         started        17 powershell.exe 25 12->17         started        19 powershell.exe 24 12->19         started        21 11 other processes 12->21 process8 process9 23 conhost.exe 15->23         started        25 conhost.exe 17->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        31 conhost.exe 21->31         started        33 conhost.exe 21->33         started        35 8 other processes 21->35
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 17:51:05 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
188937c949c23138157a707a06cca97dda5f3adc3b6f98bd07088a321d5220a5
1976401042595cb4dcafcd63e68461eab1af172f9442252b605bf4f0a49531f4
3d11505113851303d2eccdbf69ae0e87f06eb0d6bc4170326ea5c0e02e61d589
474af43d204f161ca0f2138812a1081fa7a09e5a64dc862cda83a8f23a3ff88e
be64654bb507094ad7ace4a1da27dfe42dd6451d9dadb24b8310aa50e8ff5f34
bfbfdc4aa175409b4354617bccfd96fe232ce53601cbe98738f819fcde8837f6
d6e2c72145fa1473a21537eb00dfd5f038d441c4852ba54a70234e29cc189e49
d8f37e199f10881b2045823553fd64f3f52ec616e24f2235a47dae7c435a3c72
ea7a3ae571da4778b074b401b955e1a8d8a9470bc72a7e3e45880a8f7223e652
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/201008-pzyg71fvda/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Windows security modification
Contains code to disable Windows Defender
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
165b6353a27653c087637f372f70713e4e0af658e87f03ba0703d8b975525243
MD5 hash:
112730ad698bcb62cfb8c64c4862640a
SHA1 hash:
6b42b1f3f372785c40b4f80c35d6aa2e0d012429
Link:
https://www.unpac.me/results/930c3d45-d862-46dc-bfa2-1c3f3b97f2f8/
SH256 hash:
753e4da78ae2e7451aa4b2205dbe82c211afdf049673160ed5c7ee4f6999d3d8
MD5 hash:
f474890c562f6ab688a582b21add0aa2
SHA1 hash:
86440eb15b6f7fbca5ffae9ab90191870fd9ec80
Link:
https://www.unpac.me/results/930c3d45-d862-46dc-bfa2-1c3f3b97f2f8/
SH256 hash:
88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03
MD5 hash:
f4b5c1ebf4966256f52c4c4ceae87fb1
SHA1 hash:
ca70ec96d1a65cb2a4cbf4db46042275dc75813b
Link:
https://www.unpac.me/results/930c3d45-d862-46dc-bfa2-1c3f3b97f2f8/
SH256 hash:
b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c
MD5 hash:
816a22f036e9479e6c5c21a66fb994c9
SHA1 hash:
5a7ba12257eeaa7fd8939f0b3f3d0f72312f8b09
Link:
https://www.unpac.me/results/930c3d45-d862-46dc-bfa2-1c3f3b97f2f8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/669956/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/669960/
Cape
Cape
https://www.capesandbox.com/analysis/69335/

Comments